Ask most people where a connected device is vulnerable and they picture the device: the sensor on the wall, the controller in the plant room, the camera above the door. The CIoTSP exam takes a different view. Nearly a third of ITS-110 concerns the web, cloud, and mobile portals that sit in front of those devices, because that is where account enumeration, weak default credentials, and injection flaws actually live. The hardware is rarely the easiest way in.
That weighting tells you what CertNexus thinks IoT security work really involves. This guide covers what the credential certifies, how the seven domains split, why portals dominate, and how to prepare for an exam that spans application security, network services, privacy, firmware, and physical access in a single sitting.
Table of Contents
- What Does the CIoTSP Actually Certify?
- What Does the ITS-110 Exam Look Like?
- How Are the Seven CIoTSP Domains Weighted?
- Why Do IoT Portals Carry Nearly a Third of the Exam?
- What Do Network Services and Access Control Cover?
- Why Are Data and Privacy Treated Separately?
- Why Are Firmware and Physical Security Still Examined?
- How Should You Prepare for ITS-110?
- Who Should Take the CIoTSP?
- Frequently Asked Questions About ITS-110
- Conclusion
What Does the CIoTSP Actually Certify?
The CIoTSP certifies that you can secure the environment a connected device lives in rather than just the device itself. ITS-110 covers identifying vulnerabilities across interfaces, network services, data flows, and firmware, then selecting reasonable controls and monitoring what happens afterwards. It is a practitioner credential aimed at people who ship and operate these systems.
Its most useful characteristic is that it is vendor neutral. IoT deployments are almost never single vendor, and a credential tied to one manufacturer’s stack describes a smaller job than the one most practitioners actually do.
Where It Sits Against General Security Certifications
A broad security certification teaches you principles that apply everywhere. The CIoTSP applies those principles to a specific and awkward environment: constrained devices, long deployment lifetimes, patching that may require physical access, and a management layer that is often a conventional web application with unconventional consequences.
What Does the ITS-110 Exam Look Like?
ITS-110 presents 100 questions in 120 minutes with a passing score of 60 percent, delivered through Pearson VUE. The published exam price is USD $367.50. At roughly 72 seconds per question, pacing is tighter than the question count alone suggests.
| Specification | Detail |
|---|---|
| Exam name | CertNexus Certified IoT Security Practitioner |
| Exam code | ITS-110 |
| Number of questions | 100 |
| Duration | 120 minutes |
| Passing score | 60 percent |
| Exam price | USD $367.50 |
| Delivery | Pearson VUE |
The full CertNexus CIoTSP certification outline is worth reading before booking, because the domain spread is wider than most candidates expect from an exam with IoT in the title.
How Are the Seven CIoTSP Domains Weighted?
ITS-110 divides into seven weighted domains, and the distribution is lopsided by design. One domain carries more than double the next largest, and the three smallest together account for less than a third of the exam. Studying evenly across all seven wastes effort.
| Domain | Weight |
|---|---|
| Securing IoT Portals | 29% |
| Implementing Authentication, Authorization, and Accounting | 14% |
| Securing Network Services | 14% |
| Securing Data | 14% |
| Addressing Privacy Concerns | 12% |
| Securing Software/Firmware | 10% |
| Enhancing Physical Security | 7% |
Portals plus the three fourteen percent domains account for 71 percent of the exam. If your preparation covers those four properly and treats the remaining three as revision rather than discovery, you have allocated your time sensibly.
Why Do IoT Portals Carry Nearly a Third of the Exam?
Securing IoT Portals is the largest ITS-110 domain at 29 percent because the management interface is usually the most reachable part of a deployment. Devices may sit on isolated networks, but the web, cloud, or mobile portal that configures them is exposed by design, and it is built with the same technologies as any other application.
The Named Threats You Must Recognise
- Account enumeration, where responses reveal which usernames exist
- Weak default credentials shipped and never changed at deployment
- Injection flaws reaching databases, commands, or device configuration
- Unsecure direct object references exposing other tenants’ devices
- Sensitive data exposure through verbose responses or weak transport
None of these are exotic. They are ordinary application security failures with unusual consequences, because the object being manipulated is a physical thing. Candidates from a web security background often find this domain familiar, and candidates from a hardware background often find it the hardest part of the exam. The OWASP Internet of Things project is a useful cross reference for the same failure classes.
What Do Network Services and Access Control Cover?
Two ITS-110 domains sit at 14 percent each and work closely together: Securing Network Services, and Implementing Authentication, Authorization, and Accounting. Between them they cover how a device is reached and how it decides whether the thing reaching it is allowed to.
Services as Attack Surface
Every listening service on a device is a decision someone made, often by default rather than deliberately. The exam expects you to reason about which services are necessary, how they should be exposed, and how to reduce what is reachable without breaking the deployment.
Accounting Is Not an Afterthought
The third A carries real weight here. In a fleet of devices that may operate unattended for years, the ability to reconstruct who did what and when is often the only forensic capability available. Candidates who treat authentication and authorization as the whole topic tend to lose the accounting questions.
Why Are Data and Privacy Treated Separately?
Securing Data carries 14 percent of ITS-110 and Addressing Privacy Concerns carries 12 percent, and the split is deliberate. Data security asks whether information is protected in transit and at rest. Privacy asks whether you should have collected it, how long you may keep it, and what the person it describes is entitled to know.
The distinction matters because connected devices collect continuously and incidentally. A sensor deployed for one purpose frequently gathers something else as a side effect, and a system can be cryptographically sound while remaining a privacy problem. Questions in this area reward candidates who can separate the two concerns rather than collapsing privacy into encryption.
Practitioners who have worked through the application side of this problem will recognise the pattern from secure development work, and this walkthrough of what Cyber Secure Coder teaches covers the same instincts applied at the code level.
Why Are Firmware and Physical Security Still Examined?
Securing Software and Firmware carries 10 percent of ITS-110 and Enhancing Physical Security carries 7 percent. They are the smallest domains, and they are also the two that most clearly separate IoT security from conventional IT security.
Firmware Has a Different Update Story
Update mechanisms on constrained devices are slower, riskier, and sometimes manual. The exam covers how updates are validated and delivered, and why an unsigned or unverified update path is one of the most damaging weaknesses a fleet can carry.
Physical Access Is a Real Threat Model
Servers live in locked rooms. Connected devices live on walls, poles, factory floors, and public spaces. Debug ports, exposed interfaces, and device tampering are legitimate concerns rather than theoretical ones, which is why a domain that would be unusual on an IT security exam appears here at all.
How Should You Prepare for ITS-110?
ITS-110 preparation works best when it follows the weighting rather than the order the domains are listed in. The exam rewards recognising a vulnerability class and selecting a reasonable control, so pattern recognition matters more than memorised definitions.
- Start with portals. At 29 percent it is the single highest return area, and its material is well documented elsewhere.
- Group the three fourteens. Network services, access control, and data protection interlock, so study them as one block.
- Separate privacy from security explicitly. Write down which questions each discipline answers.
- Learn the update chain. Signing, validation, delivery, and rollback, in that order.
- Walk a real deployment. Pick any connected product and list its interfaces, services, and physical exposures.
- Practise at pace. Roughly 72 seconds per question is tighter than it sounds.
Practitioners coming from an incident response background will find the transition easier than expected, and this look at the CyberSec First Responder credential shows how the same vendor structures its detection and response track.
Who Should Take the CIoTSP?
The CIoTSP suits people who already work near connected systems and need to prove they can secure them. Because it is vendor neutral and practitioner level, it travels between industries rather than being tied to one product family or one deployment style.
- OT and industrial engineers whose plant equipment is now network attached
- Security analysts responsible for device fleets alongside conventional endpoints
- Product and embedded developers building the interfaces the exam concentrates on
- Network engineers segmenting and exposing device traffic
- Solution architects designing deployments that must survive a decade in the field
The official CIoTSP certification page sets out the intended audience and renewal terms, scheduling runs through CertNexus exam delivery, and current IoT security engineer salaries give a sense of where the specialism sits commercially.
Frequently Asked Questions About ITS-110
How many questions are on the ITS-110 exam?
ITS-110 presents 100 questions in a 120 minute session. The passing score is 60 percent, which gives you roughly 72 seconds per question and makes pacing a genuine part of preparation.
How much does the CIoTSP exam cost?
The published exam price is USD $367.50. Pricing can vary where the exam is bundled with accredited training, so confirm the current figure when you book through the scheduling provider.
Which CIoTSP domain is the largest?
Securing IoT Portals is by far the largest at 29 percent, more than double the next largest domain. It covers the web, cloud, and mobile interfaces used to manage devices rather than the devices themselves.
Do I need hardware experience to pass the CIoTSP?
No. The exam is weighted toward interfaces, network services, data, and privacy rather than electronics. Candidates from application or network security backgrounds often find the largest domains familiar territory.
Is the CIoTSP vendor neutral?
Yes. It is not tied to a particular manufacturer or platform, which matters because real IoT deployments almost always mix vendors. The controls it teaches apply across whatever hardware is actually installed.
What is the difference between the data and privacy domains?
Securing Data concerns protecting information in transit and at rest. Addressing Privacy Concerns asks whether the data should have been collected, how long it is retained, and what rights attach to it. A system can be secure and still fail on privacy.
Why does an IoT exam test physical security?
Connected devices are deployed in public and semi public spaces rather than locked server rooms. Debug ports, exposed interfaces, and tampering are practical risks, so physical security carries 7 percent of the exam.
How long should I study for ITS-110?
Most candidates with relevant security experience prepare in a few focused weeks. Allocate time by domain weighting rather than evenly, since portals alone carry nearly a third of the questions.
Does the CIoTSP expire?
Certification is time limited and maintained by retaking the current version of the exam before the period ends. Check the renewal terms on the certifying body’s page when you certify, since programme terms are maintained there.
Is the CIoTSP useful without an IoT job title?
Often yes. Many practitioners inherit connected devices without the title changing, particularly in industrial and facilities environments. The credential documents capability that job titles frequently lag behind.
Conclusion
ITS-110 is an IoT exam that spends most of its attention on software. Portals carry 29 percent, and access control, network services, and data protection carry another 42 percent between them, which means roughly seven questions in ten concern things a competent application or network security practitioner already half understands. Firmware and physical security are smaller but they are where the discipline genuinely differs from conventional IT.
Study to the weighting, treat privacy as its own question rather than a subset of encryption, learn the update chain properly, and rehearse at exam pace. The credential describes a job that more people are doing every year without having chosen it.
